Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using iptables to listen to tcp (http) packets. I am filtering out INPUT responses containing a matching string. Is it possible to know which http request generated the response. Assuming 10 requests were sent to the same server and one response containing matching string was generated by one of the 10 requests. Is it possible to figure out which request generated the response using iptables, by using markers!

share|improve this question
Do you just mean at a TCP level? The destination port of the reply matches the source port of the request, so you can at least tie it to the TCP session. There may be multiple requests within a single session however. – Paul Sep 30 '12 at 12:49
Yes, there are multiple requests and responses. I want to match all responses corresponding to requests, all requests being sent to the same server – adnan kamili Sep 30 '12 at 13:14
Did you follow what I meant by source port? – Paul Oct 1 '12 at 1:40
All the browsers use http pipelining. I suppose all the requests sent by any open tab will use same source port for all the requests. Different tabs in a browser use different source ports. – adnan kamili Oct 1 '12 at 2:30
What are you trying to accomplish? – Yedric Oct 1 '12 at 13:43

iptables is not the right tool for filtering HTTP, because that protocol works on top of TCP/IP (which iptables was designed to handle). The problem is, that a HTTP request (or response) may span multiple TCP packets. A proxy (e.g. Squid) is probably a better solution for your problem. Or perhaps l7-filter.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .